Operates a social platform, in Slovenia

ZIUETDS, Uradni list RS, št. 30/2024, 11. in 17. člen · Read the law's page

• If you are a hosting service provider, remove, disable or restrict access to the online interface that a District Court order under Article 17(3) of the ZIUETDS names.
• If you are a mere-conduit provider, restrict access to the online interface, or display an express warning of the infringement on it, as a District Court order under Article 17(3) requires.
• If you are a domain registry or registrar, delete the named domain name, or temporarily delete the name servers for it, as a District Court order under Article 17(3) requires.

ZIUETDS, Uradni list RS, št. 30/2024, 3., 7. do 10., 20., 21., 25. in 26. člen · Read the law's page

• Comply with the provisions of the Digital Services Act whose breach Article 20 of the ZIUETDS makes a misdemeanor, including Articles 9, 10, 13, 14, 16, 18, 21 to 24 and 26 to 28 and, for online platforms that allow consumers to conclude distance contracts with traders, Articles 30 to 32; for example, tell the court or authority that issued an order against illegal content, without undue delay, what effect the order has had and when it took effect (Article 9(1) of the Regulation).
• Give the authorized persons of the Agency accurate and complete information, and written explanations and documentation on request within the time they set, correct incorrect, incomplete or misleading information when asked, and allow them to carry out an inspection without obstruction (Article 21(1)).

Zakon o informacijski varnosti (ZInfV-1), Uradni list RS, št. 40/25, čl. 20-22 · Read the law's page

• Article 62 defers only the adoption of the Article 21 and 22 risk-management measures, and does not mention Article 20. The Act entered into force on 19 June 2025: essential and important entities generally have eighteen months, to 19 December 2026, to adopt the measures, while an essential entity already designated as an essential-service operator and a state-administration body designated under the predecessor Zakon o informacijski varnosti, and an operator under the Zakon o elektronskih komunikacijah, have one year, to 19 June 2026.
• This binds you where you fall within Annex 1 or Annex 2's sector lists and, unless one of Article 6(2)'s no-threshold triggers applies, you have at least 50 employees and an annual turnover or balance-sheet total of at least EUR 10 million. A DNS service, TLD registry, cloud, data-centre, content-delivery-network, managed-service or managed-security-service provider, and an online marketplace, online search engine or social-networking-services platform, falls under Slovenian jurisdiction (Article 31(1)) only where its main establishment in the European Union is in Slovenia.
• Take technical, operational and organisational measures to secure the integrity, authenticity, confidentiality and availability of the network and information systems you use for your work or to provide your services, and to prevent or reduce the impact of an incident on the recipients of your services and on other services.
• Cover at minimum, on an all-hazards basis: management support for information and cybersecurity, personnel integrity checks before, during and after employment, basic cyber-hygiene practices and training, human-resources security and access-rights management, backup management, logging of events on your network and information systems, assigned responsibility for protecting the systems you run, a policy on cryptography (and on encryption where needed), traffic and communications management, and supply-chain security with minimum requirements for your key suppliers.
• Also cover physical and technical protection of the premises housing key systems, application-software security including vulnerability handling and disclosure, management and prevention of technical-vulnerability exploitation, malware protection and intrusion detection, and a policy on the cloud services you use; use multi-factor or continuous authentication where risk management needs it, and secure voice, video, text and emergency communications where suited to your activity.
• Have your responsible person, the individual who leads, supervises or manages the entity or a public-administration body's head, approve these measures and oversee their implementation, and complete cybersecurity risk-management training at least every four years.

Zakon o informacijski varnosti (ZInfV-1), Uradni list RS, št. 40/25, čl. 29-30 · Read the law's page

• This binds an essential or important entity within Priloga 1 or Priloga 2 on the same scope as this jurisdiction's companion risk-management row; Article 29(3) separately names a provider of an online marketplace, an online search engine or a social-networking-services platform, alongside a DNS, TLD, cloud, data-centre, content-delivery-network, managed-service or managed-security-service provider, for a variant significant-incident standard set in the Commission's NIS2 implementing acts.
• Treat an incident as significant where it has caused, or could cause, your organisation serious operational disruption or financial loss, or has affected, or could affect, another person by causing substantial material or non-material damage.
• Give your competent CSIRT group an early warning without delay, at latest within 24 hours of detecting a significant incident, stating whether it is suspected to result from an unlawful or malicious act and whether it may have a cross-border effect.
• Follow with a full notification without delay, at latest within 72 hours, updating the early warning with an initial assessment of the incident's severity and impact and any available threat indicators, then an interim report if the CSIRT group asks for one, and a final report at latest one month after the 72-hour notification, or a progress report and a final report within one month of resolution if the incident is still ongoing at that point.
• If you are a trust service provider, notify your competent CSIRT group of a significant incident affecting your services without delay, and at latest within 24 hours of detecting it, instead of waiting for the full notification (Article 30, paragraph 2).
• Without delay, inform the recipients of your services of a significant incident likely to adversely affect them, and communicate to a recipient potentially affected by a significant cyber threat the measures it can take in response.

Zakon o medijih (ZMed-1), 53. in 101. člen, Uradni list RS, št. 69/2025 · Read the law's page

• If you are a publisher that allows the public to comment within your medium, draw up commenting rules and publish them in a suitable place in the medium (Article 53(1)).
• Make the rules set how a comment is signed, prohibit inciting violence or hatred toward a group of persons or a member of such a group on the grounds the Act lists, allow a complaint about a breach of the rules, and set the procedure for handling complaints (Article 53(2)).
• Remove a comment that does not follow the published rules as soon as possible after a report, and at the latest within one working day of the report (Article 53(3)).

Zakon o odgovornosti za proizvode z napako · Read the law's page

• If you develop or make software, have it developed or made, or present yourself as its manufacturer, you answer as the manufacturer; free and open-source software developed or supplied outside a commercial activity is not a product (draft Arts. 5(1) point 3 and 6(1)).
• Keep supplying the software updates and upgrades needed to keep the product safe while the product is under your control; where you kept control of the product, you cannot rely on the Article 10(1) point 2 excuse (that the defect probably did not exist when you placed the product on the market) for a defect that results from software, an update or upgrade, a missing safety update, a connected service or a substantial modification (draft Arts. 9(2) and 10(2)).
• Judge safety against all the circumstances, including cybersecurity requirements, what the product can go on to learn or acquire after it is placed on the market, a recall, and the effect of other products used with it (draft Art. 8(2)).
• Keep records you could produce: on a claimant's plausible claim the court orders you to disclose the relevant data and documents available to you, and failing to do so presumes the product defective (draft Arts. 18(1) and 19(1) point 1).
• Meet the mandatory safety requirements that protect against the harm suffered: a product that does not meet them is presumed defective (draft Art. 19(1) point 2).
• If you are a manufacturer outside the EU, your importer, your authorized representative or your fulfilment service provider answers for the product in your place; a distributor or online platform answers too if no such person can be identified and it does not name one within one month of the injured person's request (draft Arts. 11 and 12).
• If you substantially modify a product without the manufacturer's consent and then make it available on the market or put it into use, you answer as the manufacturer of the modified product (draft Art. 6(2) and (3)).
• Do not rely on a contract term to limit or exclude your liability to an injured person: a term departing from the Act's rules on liability to the injured person's detriment is null (draft Art. 16).
• Be ready to prove a draft Article 10(1) excuse: that you did not place the product on the market or put it into use, that the defect probably did not exist then, that it results from complying with legal requirements, that the objective state of scientific and technical knowledge did not allow it to be discovered, or, for a component maker or a person who substantially modified the product, the component and modification excuses (draft Art. 10(1)).
• Keep the claim periods in view: three years from the day the injured person learned or should have learned of the defect, the damage and who caused it; ten years from placing the defective product on the market or putting it into use; 25 years for latent personal injury (draft Art. 15).